EnteleWALLET PR #277

Ringkasan Eksekutif

Preflight Audit completed the technical first-party release-assurance review of EnteleWALLET PR #277 and then performed a controlled release-controller trust-root rotation after the previously pinned ephemeral controller private key was found to be unavailable for legitimate future signing. The current unsigned rotated candidate is afade3aae4890eb8ecc79941fa52b8accb03e66c. Formatting, lint, type checking, localization contracts, transaction-layer controls, testnet/production separation, browser validation, Android API 30/36 validation, and multiple database/security harnesses passed on the reviewed candidate lineage. Release authorization remains intentionally pending until a fresh Ed25519 GO is signed by the newly retained controller private key and all exact-head gates pass. The current canonical v1 bundle is 1168 files with SHA-256 a449ab3515f8b72de9b156f8aacf89415310b07d4e5cc2466982bf0eedad98e2; the capability-scoped v2 bundle is 1132 files with SHA-256 f080e4b15825f486f453de27831fd847474108901057ac52a09811775f1d8dbc.

Ruang Lingkup Penilaian

• Exact repository candidate: tvk-group/entelewallet-app @ afade3aae4890eb8ecc79941fa52b8accb03e66c
• Canonical external-wallet Send source bundle v1: 1168 files / SHA-256 a449ab3515f8b72de9b156f8aacf89415310b07d4e5cc2466982bf0eedad98e2
• Capability-scoped external-wallet Send source bundle v2: 1132 files / SHA-256 f080e4b15825f486f453de27831fd847474108901057ac52a09811775f1d8dbc
• Active release-controller fingerprint: 52b49665e0e4b431d1fa579102dc2b15d333f4a29381d799201f240b6a00d4d7
• External-wallet Send transaction construction, fee/debit binding, threat screening, simulation, recipient risk, wallet/chain/account binding and duplicate-submission controls
• Release-governance signature boundary and pinned Ed25519 controller-key verification
• Browser, Android API 30/API 36 and PostgreSQL-backed production/referral/wallet-link/MEV validation evidence

Industri

Ringkasan Eksekutif

Assessment in progress. Preliminary risk classification pending final review.

Launch Readiness

Launch readiness evaluation ongoing. Final score will be published upon assessment completion.

Industri

Exact repository candidate: tvk-group/entelewallet-app @ afade3aae4890eb8ecc79941fa52b8accb03e66c

Buka Verifikasi

Operational readiness patterns reviewed including disclosure, monitoring, and deployment boundaries.

Rincian Temuan

Security review completed under First-Party Wallet Security + Release Assurance methodology with structured finding classification.

Rincian Temuan

Sorotan Utama

• Automated format, lint, typecheck and i18n gates passed for the reviewed candidate lineage
• EnteleWALLET 1.1 transaction-layer gate and external-wallet activation security checks passed
• Testnet Send mainnet-impossibility and testnet/production separation gates passed
• Playwright and Android API 30/API 36 validation passed in the reviewed candidate evidence
• Protected release controls correctly fail closed until a fresh signature from the rotated permanent controller verifies against the exact current source bundle

Tanggal Penilaian

Terkait

• EnteleKRON — PFA-2026-000011
• SOVRA — PFA-2026-000010
• EnergieMIND — PFA-2026-000009
• TVK ID — PFA-2026-000018